News for hackers. Stuff that matters.

A comment on Robinhood Stored Passwords in Plaintext. Parent comment

Re:Robinhood Stored Passwords in Plaintext by eximius on Thursday July 25, 2019 @10:31AM (#20525663)
This is why there is client side hashing. You still hash+salt on the server side, but the client side hashing prevents the worst kind of exposure.
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by hkai on Thursday July 25, 2019 @02:03PM (#20527776)
What's the significant difference between sending a plaintext password and a sha256(plaintext password) to the server, except if the user reuses that password on other sites?
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by eximius on Thursday July 25, 2019 @03:54PM (#20528924)
> except if the user reuses that password on other sites

Except you can't really except that.

[ Parent | on HN ]